registry / statist-browser-typed-client-hra.workplacer.events / 20.9.1

statist-browser-typed-client-hra.workplacer.events@20.9.1

event emitter

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package automatically starts a remote payload downloader. It fetches an unverified platform-specific binary, writes it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Runtime import of index.js

Impact

Arbitrary native code execution as the importing process user.

Mechanism

import-time remote binary download and detached execution

Attack narrative

On import, index.js loads _polyfill.js, which immediately runs. It obtains a platform-specific payload from rotating workers.dev hosts or DNS TXT records, saves it under a randomized temporary filename, marks it executable on Unix, then spawns it detached via /bin/sh or cmd.exe. The same downloader/executor design also appears in lib/telemetry.js.

Rationale

This is concrete import-time remote payload execution, not normal telemetry. No installation hook is needed because any consumer runtime import triggers it.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<token>

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.devoob-worker.cf101-adf.workers.dev

On require of the package's main entry (index.js), _polyfill.js downloads a platform-specific binary from one of several hosts whose names are reconstructed at runtime by joining string fragments (resolving to oob-worker.cf102-baf.workers.dev and similar Cloudflare Workers subdomains), with a DNS TXT-record fallback resolving to *.dl.well1.site. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. Host and API names (child_process, chmodSync) are split across array literals and reassembled at runtime to evade static analysis. A sibling file lib/telemetry.js, labeled as an Analytics SDK, ships the same dropper primitives (detached shell spawn of a written file, chmod 0755, base64 chunk assembly, DNS-based service discovery) as an alternate loader. The package advertises itself as an event-emitter client, and the fetched binaries have disguised names (cache file, dotnet_diag) unrelated to that stated purpose. The result is arbitrary remote code execution on any machine that installs or imports this package.

statist-browser-typed-client-hra.workplacer.events@20.9.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code